It is often useful to obtain traffic flow measurements in a network that utilizes a protocol such as the Internet Protocol (IP). For example, such measurements may be used to characterize flows using parameters such as flow duration, volume, time, burstiness, etc. Flow traffic information may be useful for network planning, optimizing network resource utilization or traffic performance, detection of and defense against network attack/intrusion, quality of service (QoS) monitoring, usage-based accounting, etc.
Traffic flow measurements may be made by a network bridge, switch or router, for example, or some other measurement device. Then, these measurements may be utilized by various applications such as a traffic profiling application, a traffic engineering application, an attack/intrusion detection system, an accounting application, a QoS validation application, etc. For example, a traffic profiling application may utilize flow measurements taken at multiple different nodes (e.g., routers, bridges, switches, etc.) in a network so as to analyze traffic in different portions of the network. Various definitions and requirements for export of IP flow information and for metering processes have been proposed by the Network Working Group of the Internet Society at least in the Request for Comments 3917, “Requirements for IP Flow Information Export (IPFIX)”, 2004 (RFC 3917).